Is the file you deleted really gone?
That file you thought you deleted could still be on your drive
When you delete a file on your computer, its first stop is usually in your operating system’s “recycle bin” or “trash” folder. It is placed in this temporary trash area in case you change your mind and want to retrieve the file later.
Most people assume that once they take the extra step of “permanently” deleting the file from the recycle bin, that they are now officially off their hard drive and past the recovery point.
CLOSE
What many people don’t know is that there is a high possibility that recoverable data may remain on their hard drive even after they delete the file from the recycle bin/trash area.
If I have deleted a file, why is it still recoverable?
According to Wikipedia, Data Remanence is “the residual representation of digital data that remains even after attempts to remove or delete the data”.
When you delete a file, the operating system may simply remove the pointer record to the file, making it inaccessible through the operating system’s file browsing tools. This does not mean that the actual data is ever removed from the drive.
Forensic data tools may help bring records back from the dead
Many computer forensics specialists make a living recovering files that people (including criminals) might have thought were destroyed. They use specialized recovery software that scans the disk media for identifiable data. These special tools are created to ignore the traditional limitations imposed by an operating system and its file system. The tools look for file headers used by software applications such as Excel, Word, and others to determine what type of data may be recoverable.
What the tools can actually recover depends on several factors, such as whether the file data is intact, overwritten, encrypted, etc.
Amazingly, it is sometimes still possible to recover data on a drive that was thought to have been formatted. If “quick format” was used, then only the file allocation table (FAT) may have been erased, potentially allowing the recovery of files that would have been thought to have been deleted during the formatting process.
Criminals buy used hard drives
Cybercriminals know that data is often recoverable on discarded hard drives. They can search yard sales, Ebay auctions, Craigslist ads, etc., for used computers, hoping to use forensic tools to recover their personal data from discarded hard drives. They could use this information for purposes of identity theft, extortion, blackmail, etc.
How can you be sure your file is gone for good?
Before selling or getting rid of an old computer, it is best to remove and keep your hard drive. You could completely wipe the hard drive with military-grade disk cleaning utilities, but you can’t be absolutely sure that some new forensic technology won’t come out in the not-too-distant future, allowing the recovery of data that was previously unrecoverable using current methods. For this reason, it may be best not to sell your old hard drive with your old computer.
Things that can help get rid of this deleted file for good:
Reconstruction
Many file recovery utilities warn users that defragmenting the hard drive may reduce the chances of files being recovered because the defrag process itself consolidates the data and may overwrite the areas where the deleted data existed. While it may help, simply defragmenting your drive won’t make the data unrecoverable, so you shouldn’t use it as a wipe method.
Data encryption
Forensic tools may be able to decrypt the data, but if the encryption is strong enough then the tools may not be able to resurrect the contents of a file. Consider enabling your operating system’s disk encryption feature to take advantage of this feature. Also, you can use worksprey like TrueCrypt to encrypt your sensitive files.
